I've heard there may be security concerns when using ImageMagick on arbitrary user-provided images. For example, the link below gives evidence that there used to be some buffer overflow exploits. Does anyone know if I can now safely use this as part of a web service dealing with user images?
That security advisory is from 2006. All software has bugs, but I wouldn't say that ImageMagick has more than other software. Seriously, if you are implementing a web service, you're probably just as likely to get hacked by someone through Apache than with ImageMagick.
In short, don't worry about it, but do keep all your software up to date.
EDIT: by the way, I helped a client implement a web service that used ImageMagick, and I never heard of one problem with it.
Yes there is a security risk - software has bugs and some of them can be used to attack the system it runs on.
But you can minimize the risk:
Create a user account that has a minimum of permissions so that it is just enough for running ImageMagick. Now use only that account for executing ImageMagick
Enable automatical security updates: Linux systems like Ubuntu can be configured to install automatically install security fixes. This decreases the time your system is vulnerable in case a vulnerability will be found. Windows system also has an auto update system but that does not include third party software like ImageMagick.
ImageMagick was designed for flexibility. It is not hardened against crafted inputs the way a browser's image processing libraries are. It will probably continue to be much easier to find exploitable bugs in a library like ImageMagick than in a browser.
An attacker who finds a buffer overflow in ImageMagick can then use that to run arbitrary code with the permissions of the process running ImageMagick.
This can give an attacker a beachhead that they can use to escalate privileges further; for example via PATH and trojan horse attacks, by confusing other backends or by exploiting other, unpatched services inside your production environment.
If you absolutely must use ImageMagick on third party content, see "Other Security Considerations" in ImageMagick's security policy docs:
In addition to the security policy, you can make ImageMagick safer by ...
- keeping ImageMagick up-to-date. The latest releases have fixes for any security flaws we discovered in the past.
- sanitizing any filenames or command line options you pass to ImageMagick.
- running ImageMagick in a sanitized software container such as Docker.
- running ImageMagick as the least-privileged user (e.g. 'nobody'). explicitly setting the image file type. For example, use the filename png:image.png rather than image.png. Without an explicit image type in the filename, ImageMagick guesses the image type.